movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-15 05:59:17 +03:00
Code Issues Projects Releases Packages Wiki Activity

nixos/postgresql: run ExecStartPost as an unprivileged user

Browse source
This commit is contained in:
Aaron Andersen 2020-08-12 21:06:31 -04:00
parent edd758839c
commit ec82ae3c39
2 changed files with 16 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nixos/doc/manual/release-notes/rl-2009.xml
View file

@ -666,11 +666,19 @@ services.dokuwiki."mywiki" = {
<listitem> <listitem>
<para> <para>
The <xref linkend="opt-services.postgresql.dataDir"/> option is now set to <literal>"/var/lib/postgresql/${cfg.package.psqlSchema}"</literal> regardless of your The <xref linkend="opt-services.postgresql.dataDir"/> option is now set to <literal>"/var/lib/postgresql/${cfg.package.psqlSchema}"</literal> regardless of your
<xref linkend="opt-system.stateVersion"/>. Users with an existing postgresql install that have a <xref linkend="opt-system.stateVersion"/> of <literal>17.09</literal> or below <xref linkend="opt-system.stateVersion"/>. Users with an existing postgresql install that have a <xref linkend="opt-system.stateVersion"/> of <literal>17.03</literal> or below
should double check what the value of their <xref linkend="opt-services.postgresql.dataDir"/> option is (<literal>/var/db/postgresql</literal>) and then explicitly should double check what the value of their <xref linkend="opt-services.postgresql.dataDir"/> option is (<literal>/var/db/postgresql</literal>) and then explicitly
set this value to maintain compatibility: set this value to maintain compatibility:
<programlisting> <programlisting>
services.postgresql.dataDir = "/var/db/postgresql"; services.postgresql.dataDir = "/var/db/postgresql";
</programlisting>
</para>
<para>
The postgresql module now expects there to be a database super user account called <literal>postgres</literal> regardless of your <xref linkend="opt-system.stateVersion"/>. Users
with an existing postgresql install that have a <xref linkend="opt-system.stateVersion"/> of <literal>17.03</literal> or below should run the following SQL statements as a
database super admin user before upgrading:
<programlisting>
CREATE ROLE postgres LOGIN SUPERUSER;
</programlisting> </programlisting>
</para> </para>
</listitem> </listitem>

13
nixos/modules/services/databases/postgresql.nix
View file

@ -225,14 +225,15 @@ in
Contents of the <filename>recovery.conf</filename> file. Contents of the <filename>recovery.conf</filename> file.
''; '';
}; };
superUser = mkOption { superUser = mkOption {
type = types.str; type = types.str;
default= if versionAtLeast config.system.stateVersion "17.09" then "postgres" else "root"; default = "postgres";
internal = true; internal = true;
readOnly = true;
description = '' description = ''
NixOS traditionally used 'root' as superuser, most other distros use 'postgres'. PostgreSQL superuser account to use for various operations. Internal since changing
From 17.09 we also try to follow this standard. Internal since changing this value this value would lead to breakage while setting up databases.
would lead to breakage while setting up databases.
''; '';
}; };
}; };
@ -336,7 +337,7 @@ in
setupScript = pkgs.writeScript "postgresql-setup" ('' setupScript = pkgs.writeScript "postgresql-setup" (''
#!${pkgs.runtimeShell} -e #!${pkgs.runtimeShell} -e
PSQL="${pkgs.utillinux}/bin/runuser -u ${cfg.superUser} -- psql --port=${toString cfg.port}" PSQL="psql --port=${toString cfg.port}"
while ! $PSQL -d postgres -c "" 2> /dev/null; do while ! $PSQL -d postgres -c "" 2> /dev/null; do
if ! kill -0 "$MAINPID"; then exit 1; fi if ! kill -0 "$MAINPID"; then exit 1; fi
@ -362,7 +363,7 @@ in
'') cfg.ensureUsers} '') cfg.ensureUsers}
''); '');
in in
"+${setupScript}"; "${setupScript}";
} }
(mkIf (cfg.dataDir == "/var/lib/postgresql/${cfg.package.psqlSchema}") { (mkIf (cfg.dataDir == "/var/lib/postgresql/${cfg.package.psqlSchema}") {
StateDirectory = "postgresql postgresql/${cfg.package.psqlSchema}"; StateDirectory = "postgresql postgresql/${cfg.package.psqlSchema}";